Dynamic service access

A system, comprising:

• a first node comprising an identity service (IS) arranged to:
• receive a request from an application, via an authenticated desktop client, for a virtual service internet protocol (IP) address associated with a service, wherein the virtual service IP is intercepted by the apparatus and not sent on to a network containing the application;
• build a routing token that includes an original physical IP address associated with the service when a policy associated with the IS permits access to the service by a user identity associated with the authenticated desktop client;
• and
• transmit the routing token to a validation node so that the application can be connected using an original connection to the service via the authenticated desktop client after the validation node has validated the routing token;
• and
• a second node to host the service.

A processor-implemented, method to execute on one or more processors that perform the method, comprising:

• authenticating a desktop client to an identity service (IS);
• receiving a request, from an application, at the IS via the desktop client, for a virtual service internet protocol (IP) address associated with a service, the receiving including intercepting the virtual service IP and not sending the virtual IP on to a network containing the application;
• building a routing token, by the IS, to include an original physical IP address associated with the service when a policy associated with the IS permits access to the service by a user identity associated with the desktop client;
• and
• after validating the routing token, connecting the application using an original connection to the service via the desktop client.

A processor-implemented method to execute on one or more processors that perform the method, comprising:

• authenticating a desktop client to an identity service (IS);
• receiving a request, from one of an e-mail application or a remote control application, at the IS via the desktop client, for a virtual service internet protocol (IP) address associated with a service, the receiving including intercepting the virtual service IP and not sending the virtual IP on to a network containing the application;
• building a routing token, by the IS, to include an original physical IP address associated with the service when a policy associated with the IS permits access to the service by a user identity associated with the desktop client;
• and
• after validating the routing token, connecting the one of the e-mail application or the remote control application using an original connection to the service via the desktop client.